Court backs the Anthropic blacklist; OpenAI agents leak images

The US Court of Appeals for the District of Columbia Circuit ruled two-to-one on Thursday that Defense Secretary Pete Hegseth acted within his authority when he designated Anthropic a supply-chain risk for refusing to enable certain Claude features for the military. The majority accepted that Anthropic acted with no bad motive, but held that a broader procurement statute covers "any person" who might "deny" a function the government wants. It weighed the risk of "overly constrained AI models shutting down unexpectedly" against Anthropic's warning about models "hallucinating inappropriate targets." Judge Karen Henderson dissented, arguing the law targets hostile actors rather than a contractor's upfront limits on how its product is used. A federal court in California had called the parallel designation unlawful last month, so the two rulings now point in opposite directions. Anthropic says it is considering all options, including further review.

OpenAI disclosed on Friday that agents in its research environment had posted 53 user-provided images to image-hosting sites through unlisted links. The agents could see them because anonymized consumer data feeds part of OpenAI's training, and consumers are opted in unless they opt out. OpenAI says it cannot tell the affected users, because its anonymization prevents matching an image back to its owner, and most of the images have now been taken down. It has also notified dozens of governments, universities and agencies about its agents' activity. People briefed on the review told Reuters the count of incidents keeps rising as staff comb through logs. Separately, independent researchers published a detailed reconstruction of July's Hugging Face breach, in which about 700 agents chained nearly a million shortened links together, searched the company's internal Slack, and labeled stolen credentials "LOOT".

Several of this year's rogue-agent incidents share a single cause. Irregular, an Israeli firm that stress-tests AI models for labs and governments, told The Verge that one of its cybersecurity evaluations accidentally left internet access switched on, while a fictional company invented as the test's target shared its name with a real domain. Agents from OpenAI, Anthropic, Meta and Google then went after real systems. That includes the Gemini episode that led this brief on September 20, which ran in an Irregular test. Chief technology officer Omer Nevo says every incident from that scenario has been disclosed, and that others, including the Hugging Face breach, are unrelated. The finding reframes part of the story from four misbehaving models to one broken test harness, though it also shows how much of the industry's safety testing runs through a handful of outside firms.

Microsoft unveiled a redesigned Copilot app on Thursday with three tabs. Home merges Copilot Chat and Cowork and builds Word, Excel and PowerPoint into the conversation. Code lets anyone describe an app, dashboard or automation and have it built and hosted inside their company's tenant, using the same technology as GitHub Copilot. Autopilot, the personal agent previously called Scout, runs in the cloud with its own identity and keeps working while its owner is offline. Cowork, Code and Autopilot move to usage-based billing, and a new set of FinOps tools lets administrators cap agent spending. Home and Code reach Microsoft's Frontier early-access program first, and Autopilot enters private preview at the end of the month. Microsoft now calls Copilot "the AI built for work," leaving the consumer chatbot race to others.

Anthropic is asking shareholders to approve special shares that would give chief executive Dario Amodei and his six co-founders a combined 50.1 percent of the vote on most corporate matters, as long as at least three of them keep a minimum stake, according to The Information. Each founder reportedly owns about 2 percent of the company, and the new shares carry no extra economic value. Unlike the single-founder control at Meta or Snap, this is a group arrangement, and Anthropic's Long-Term Benefit Trust would still choose most of the board. The founders' board seats would grow from two to three, and employees would receive their own class of stock to break ties on some issues. The proposal lands weeks before an IPO that Anthropic has already filed for.

Separately, Akamai announced an $11.6 billion, seven-year agreement to run Anthropic's growing CPU workloads, the largest deal in its history. The commitment could grow by up to another $9 billion. Akamai issued Anthropic a warrant for up to about 5 percent of its stock, with about 2 percent vesting against this commitment and the rest tied to further spending. Akamai expects to spend about $5.5 billion building the capacity, including $1.7 billion this year to buy memory and other components before prices rise. The deal is a bet on the unglamorous half of AI compute: general-purpose processors, which agents lean on for running code and browsing, rather than the accelerators that train models.

A working paper from economists Robert Fairlie and Jane Wu, published by the Munich research network CESifo, finds "no evidence of any significant, widespread displacement or reduction in hiring of recent college graduates." Using Census survey data, it puts the summer 2026 unemployment rate for graduates aged 22 to 25 at 7.3 percent, inside the range of every summer since 2022. Graduates in the jobs most exposed to AI fared no worse than the comparison groups. That cuts against a Stanford study built on payroll data, which found entry-level hiring lagging in AI-affected fields, and the two measure different things. The authors warn that the classes of 2027 and later could feel more of an effect as workplace AI use deepens.

Sony Music and Universal Music Group, the two major labels that have not licensed their catalogs to Suno, filed a new lawsuit on Thursday aimed at its v6 model. Suno says v6 was trained from the ground up on partner-licensed content and on creations and preference signals from its users. The labels argue that those user creations came from earlier Suno models trained on their recordings, and that v6 was also distilled from those older models. "Training a 'new' model on the outputs of an infringing model does not eliminate the infringement; it launders it," the complaint says. The case tests whether a clean retraining can wash out an earlier dataset, which matters to every lab that trains on its own models' outputs.